CISEC-IT study plan

Draft a one-page comparison of the board's governance duties versus the security executive's operational duties, citing at least four distinct decision rights.

Map every element of a security strategy (vision, risk appetite statement, roadmap, funding model) to the executive audience that approves it.

Build a risk register template with columns for likelihood, impact, velocity, control maturity, owner, and treatment option, then populate it with five realistic enterprise scenarios.

Explain in writing how risk appetite and risk tolerance differ, and give one quantitative tolerance threshold for each of three risk categories.

Compare at least three enterprise risk frameworks on structure, scoring approach, and reporting output, and state which fits a mid-size regulated firm and why.

Compute a simple quantitative risk estimate for two scenarios using annualized loss expectancy and show the arithmetic.

Write a 200-word risk acceptance memo that a business owner could sign, including residual risk and review date.

Identify three key risk indicators and define the threshold at which each would trigger escalation to the board risk committee.

Inventory the privacy and sector regulations touching a sample organization and classify each obligation as notice, consent, retention, breach notification, or vendor flow-down.

Draft a data inventory entry for three data types showing lawful basis, retention period, cross-border transfer mechanism, and deletion trigger.

Outline the steps and clocks of a breach notification decision, distinguishing who must be told, within what window, and by whom.

List five contractual clauses a security leader should require in processing agreements and justify each in one sentence.

Diagram a reference security architecture across identity, endpoint, network, data, and cloud layers, labeling the control objective at each layer.

Evaluate three technology proposals (for example CASB, PAM, or microsegmentation) against a stated risk reduction case and recommend one with a written rationale.

Define an access governance model covering joiner-mover-leaver, privileged access, periodic recertification, and exception handling.

Specify a data classification and handling standard with four tiers and the controls required at each tier.

Construct a severity classification scheme with four levels and the escalation path and timing for each.

Draft the first 24 hours of an incident response playbook for ransomware, naming decision points, communications, and evidence preservation steps.

Define recovery time and recovery point objectives for three critical business services and identify the dependency chain behind each.

Design a crisis communication protocol covering internal escalation, regulator contact, customer notice, and media holding statement.

Build a tiered vendor risk assessment process distinguishing due diligence depth by data sensitivity and criticality.

Write five security requirements to embed in procurement contracts and identify the evidence a vendor must supply to prove each.

Map fourth-party and concentration risk for three critical suppliers and propose one mitigation for each.

Draft an offboarding checklist for vendor termination covering data return, access revocation, and certificate of destruction.

Design a role-based awareness curriculum with three audience segments, delivery cadence, and a behavior-based success measure for each.

Select four security metrics that tie to business outcomes and specify data source, calculation method, and target for each.

Build a one-page budget justification that translates two proposed investments into risk reduction and cost avoidance.

Draft a five-slide board briefing outline that leads with risk posture, not tooling.

Synthesize the prior seven weeks into a single one-page security program narrative linking strategy, risk, compliance, and metrics.

Rehearse and time a ten-minute executive presentation defending one funding decision under challenge.

Complete a timed 60-question mixed-domain practice set and log every miss by domain and root cause.

Rewrite each logged miss into a corrected one-sentence rule you can recall under exam pressure.